Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16/01/2025, 20:31
General
-
Target
6b146c5ce365cba99f25e10535011a4a1b107a2e972dddb7d97204154233c8acN.dll
-
Size
768KB
-
MD5
6e095303f4a13d3abc3570c81c9770b0
-
SHA1
51d72095910bcee40e9ca5d3faedf1b3072b5e0a
-
SHA256
6b146c5ce365cba99f25e10535011a4a1b107a2e972dddb7d97204154233c8ac
-
SHA512
602eccf8d5b16cc78409f912752b594c7d01d0eaa79c7723b491a3c48ee19a5b1885769cecabdced0eccb1f7b045237bd8616b4949e36b09a75616aa0277dc6e
-
SSDEEP
12288:J4vNC4bAo/u7kwVKwtKFjZMrCx1U6RjUEjkxDekdIppEiQ/W+nxtnP4DqMX9z6Vo:J4ld9/EkwVK+KFjZBxJ4PgGnMsMryIxN
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b146c5ce365cba99f25e10535011a4a1b107a2e972dddb7d97204154233c8acN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\1rQPyl\recdisc.exeC:\Users\Admin\AppData\Local\1rQPyl\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\ixJv2o\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\ixJv2o\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\0CWHXG\raserver.exeC:\Users\Admin\AppData\Local\0CWHXG\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772KB
MD53d739f6f0ba86cf5c2bff996142fb30b
SHA1ad2faa92e809bd7f1ce5511fcb405d5d118a9cf1
SHA25622916837a68aea45b15cad4a0fd3f77d72c0286801d487ed58cc497c5791a7e4
SHA51272260b889b82afb54c75b35ad14ccfd1d9a8fbbd44625c21c38d1fc962c0c3c5550ec853d92fbb31707aeb59daf71d15fd4ac21b32d9577faa2e9b217e570af7
-
Filesize
772KB
MD59b06ea6a2a12a510d79f0fa808fe81c4
SHA1e582c2b780aad2ac982fabee3389201749a54ec1
SHA256fd2baf85ab6b7895e23116db6084c27aad7bd47cdbeed881e380406b37141be4
SHA512b7610a06efa38763d3b8898bae5e4fdb97e9359f5f7115c3a0c60b03120585f363c3873ef8f9341f82ccdad8fac63646bbc12f45069ebc43781678e064d535c3
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
796KB
MD533443cbe0de4873e4389a70a14b785fc
SHA183b543b37e436f14a6b55a84ce3da60987018ff0
SHA256714496af8c1ec9c8c962d5e7e2d208c9b0cb68786cee04fd0a69720cb33a23d6
SHA512e22d5b68f9d39de7038fa8722980be9d5140dfb656c220aefb1ed452a75b3a9ad55d200015f76b1bd4c7eab3bb603193ceeb87125a02733e5ef2b0223ec37654
-
Filesize
1KB
MD5c20507c71edfe750fcf7fa67a0d6f2fa
SHA1479f9a3f24c8f86013d19c3ab45f611c5d3623e0
SHA2560269f779da9d09ca4dd795094275aaea894dc4369d622b77212424526dcec4b3
SHA51220f8aaadf3b9765042cf87e213d22cad876ff2960be3246da04955bb06f381eb1a620aaa392e83d9918bf774b32a4e458949935f87362b4c1572bbbb1a31348d
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
232KB
MD5f3b306179f1840c0813dc6771b018358
SHA1dec7ce3c13f7a684cb52ae6007c99cf03afef005
SHA256dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0
SHA5129f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB